Wikipedia:WikiProject on open proxies

←Administration index

MetaProject on open proxies (en-Wikipedia chapter)

If you've been blocked as an open proxy, please see: Help:blocked. The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Open proxies may be blocked from editing

Reporting

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.	For block requests:
	Verify that the following criteria has been met: The IP has made abusive contributions within the past week
	For unblock requests:
	Verify that the following criteria has been met: No current criteria
II.	For block requests	For unblock requests
	Replace "IP" below with the IP address you are reporting.	Replace "IP" below with the IP address you are reporting.
III.	Fill out the resulting page and fill-in the requested information.
IV.	Save the page.

Requests

Archive page 1

217.112.171.197

– This proxy check request is closed and will shortly be archived by a bot.

217.112.171.197 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock at User talk:Svick#Unblocking my current IP. To my untrained eyes, it appears to still be open on port 8080, but I'll leave it up to the experts for verification. Thanks ​—DoRD (talk)​ 16:50, 30 December 2011 (UTC)

This is very interesting... this looks like it was an open proxy as of very recently (i.e. a few hours ago). However, it doesn't proxy for me right now on either of the alleged proxy configurations I've seen. I wouldn't unblock the IP right now, but I would grant IPBE to the user so they can get back to editting. Sailsbystars (talk) 17:08, 30 December 2011 (UTC)

IPBE granted. — Edokter (talk) — 17:58, 30 December 2011 (UTC)

Putting on hold for now. I (or another proxychecker) will check again in a few days to see if the IP is clear. Sailsbystars (talk) 15:53, 31 December 2011 (UTC)

So this is a problem. It's still a proxy or zombie computer.... I'll leave a message on the user's talk page explaining. Sailsbystars (talk) 01:26, 18 January 2012 (UTC)

184.173.245.20

– This proxy check request is closed and will shortly be archived by a bot.

184.173.245.20 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Escapeeyes again. nslookup gives "gator1842.hostgator.com" this time. --GenericBob (talk) 08:44, 25 December 2011 (UTC)

Likely IP is an open proxy I looked into this briefly, can't find the exact proxy mechanism, although it clearly is a proxy because it's spammed a certain blue pill across wide swaths of the internet. It belongs to the range 184.172.0.0/15 which is "the Planet" hosting, who I thought we had already blocked a long time ago for repeated hosting of open proxies.... Sailsbystars (talk) 14:41, 25 December 2011 (UTC)

I can't actually block anything that size...and i'm not going to be blocking 256 /16s :P blocked the /18 though. -- DQ (ʞlɐʇ) 11:06, 21 January 2012 (UTC)

220.255.1.0/26

– This proxy check request is closed and will shortly be archived by a bot.

220.255.1.0/26 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock. Multiple requests to the unblock-en mailing list from the IP range. Seems that Singaporean ISP maybe putting customers through a local proxy, rather than open proxies. Spoke with admin placing block and their memory of the specifics of the incident are now vague beyond a check was run. Thanks . — billinghurst sDrewth 01:38, 8 January 2012 (UTC)

I'm on my way out of town, but I looked into this briefly. It looks like a closed proxy or web-accelerator type service for the customers of that ISP. It was also a ridiculously active range for a /26 (actually, this apparently came up before and the entire /22 is ridiculously active....). I vaguely remember seeing this exact range before myself, but can't find where I intersected with it..... I recommend unblocking, but someone else should look at this who can do a more thorough check. Sailsbystars (talk) 03:22, 8 January 2012 (UTC)

I will unblock it, and we can continue testing, if it is problematic we can just reapply, that is nothing new. Yet more mail from the IP range. — billinghurst sDrewth 13:10, 9 January 2012 (UTC)

Nothing is indicating anything further on my end...so i'm going to close this. -- DQ (ʞlɐʇ) 11:06, 21 January 2012 (UTC)

69.22.170.0/24

– This proxy check request is closed and will shortly be archived by a bot.

69.22.170.0/24 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

This has been blocked for a year, have a request to unblock-en, can we please check the range to determine whether it still is problematic. Thanks — billinghurst sDrewth 02:48, 15 January 2012 (UTC) Reason: Requested unblock.

Errr... this looks like an anonymising program to me. And is coming from a colocation provider which no one has to edit from. The unblock request had better be more specific than "unblock please." The program is free to download and specifically hides IPs, and jumps around a lot in the range. I don't see why the block shouldn't be extended, recent proxy like actions as of Dec. 6 2011. Any unblock request should contain specific reference to why they have to edit from that IP range..... A second opinion is welcome of course.... Sailsbystars (talk) 14:16, 15 January 2012 (UTC)

I have to agree, I know this companies proxy pretty well, and they stick around for a long time, but in interest of compromise, 2 years sounds fine. Also Spellcast knows what he's doing and catches all those IPs. -- DQ (ʞlɐʇ) 11:06, 21 January 2012 (UTC)

195.189.142.176

– This proxy check request is closed and will shortly be archived by a bot.

195.189.142.176 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Blocked 4+ years ago, time to review following email to unblock-en 1 October 2007 Ryulong (talk | contribs | block) blocked 195.189.142.176 (talk) (account creation blocked) with an expiry time of indefinite ‎ ({{blocked proxy}}: Opera Mini Demo interface) (unblock | change block) Reason: Check for ongoing validity. Thx — billinghurst sDrewth 13:24, 17 January 2012 (UTC)

Inconclusive This one is complicated. I tried the opera mini demo interface and sure enough it works nice and open proxy like. However, I came out as 82.145.208.189 (talk · contribs · info · WHOIS). It's possible that opera has shifted around their IPs such that the demo interface uses. Or alternately, the demo interface dynamically choose random opera IPs, just like the real browser. On the one hand, opera mini IPs are pretty similar to any cell provider, which we generally don't long term block. On the other hand, the demo interface allows people to access it from their full computers. I lean towards unblocking. Sailsbystars (talk) 01:13, 18 January 2012 (UTC)

Inconclusive also, and agree with the above assessment, therefore unblocked. Though I did that it generates random IPs, so i've blocked the /20 and we'll try later to see if this one comes back. -- DQ (ʞlɐʇ) 10:10, 21 January 2012 (UTC)

216.17.107.51

– This proxy check request is closed and will shortly be archived by a bot.

216.17.107.51 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

There is an unblock request at User talk:216.17.107.51. There are, in fact, two range blocks affecting that IP address, one is a checkuser block, which I have referred to the blocking checkuser/admin. The other is a proxy block, and I would be grateful if someone could check it. The user says "this ip is not an open proxy and is only used by me." The block log entry is 07:07, 15 June 2007 Ryulong blocked 216.17.104.0/21 (talk) (account creation blocked) with an expiry time of indefinite ‎ ({{blocked proxy}}). JamesBWatson (talk) 11:38, 20 January 2012 (UTC)

Reason: Requested unblock.

I've lifted the one, this is probably a different person than the one who caused the block. Range was exclusively used by one persistent troublemaker in the past three months, but it's not important enough ATM if it causes collateral damage.
I have also lifted the proxy block: I'd be surprised if the whole /21 was ever used exclusively by open proxies, and it's been 4.5 years since it's been set anyway. Amalthea 18:41, 20 January 2012 (UTC) Note this was copied from a TP after the below cmt. -- DQ (ʞlɐʇ) 15:35, 23 January 2012 (UTC) — Sorry, I thought it would help to give your reply context. ;) Amalthea 15:58, 23 January 2012 (UTC)

I have to disagree with Amalthea's assesment, because it looks like we have a webhost here on the /21. Not that this IP contains proxies, but it does contain sites like [searchengineadult.com this one]. Can I have someone double check me just to make sure i'm not just being tired? -- DQ (ʞlɐʇ) 11:06, 21 January 2012 (UTC)

You're right that 216.17.96.0/20 is registered by a hosting company, but it's not that the whole range is populated by open proxies. Are we routinely blocking webhosts? Amalthea 11:03, 23 January 2012 (UTC)

Yep, webhosts are blocked these days. -- DQ (ʞlɐʇ) 15:35, 23 January 2012 (UTC)

Ah, well then, feel free to re-block the /20 for whichever duration is appropriate. Do we have a guideline page on that? I can't quite get that aligned with my understanding of WP:BLOCK#PREVENTATIVE … Amalthea 15:58, 23 January 2012 (UTC)

I don't know where your getting the /20 from, but that would cause some collateral damage when we can hit some smaller ranges including to a group of sprint customers (it's just the first name I recognized off the list. 216.17.100.0/22 and 216.17.104.0/21 blocked for a year. As for a guideline, WP:PROXY covers this as an anonymous proxy, and so does the blocking policy, but they should get an update with some more detailed info on why we block them. It's primarily because there is no reason for webhosts to be editing. They aren't individuals, and usually are trying to evade a block when doing so. (I've seen too many examples of this) So we always hardblock the ranges. -- DQ (ʞlɐʇ) 17:25, 23 January 2012 (UTC)

I'm getting 216.17.96.0/20 from the whois record ([1]). The whole range is assigned to a1colo.com aka amerinoc.com. Where are you getting the 216.17.104.0/21 from?
And it's in my opinion quite a leap to call any closed webserver an Anonymizer. I can get on board saying that end-users are very unlikely to use it for normal editing, but like I said, I wouldn't call it "imminent or continuing damage and disruption". If there is disruption from one, we can handle them like any other static IP. Amalthea 18:31, 23 January 2012 (UTC)

Sorry for the delay in response, the /21 is from the Robtex link above, which I personally tend to find the most accurate, but that's me. As far as Webhosts being blocked, i'll take that to the talkpage. -- DQ (ʞlɐʇ) 20:41, 25 January 2012 (UTC)

202.156.10.9

– This proxy check request is closed and will shortly be archived by a bot.

202.156.10.9 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

A number of requests via unblock-en, and there seems a hint of IP proxy, especially I rDNS I find it is

Singapore Serangoon Starhub Cable Vision Ltd
Resolve Host: 202.156.10.9.cache.maxonline.com.sg
IP Address: 202.156.10.9

If we could at least check and rule out open proxy (as history previously as open proxy, though not currently labelled that way, just problematic), then we can modify how we handle requests from this IP.
Reason: Check only at this stage. Thanks. — billinghurst sDrewth 01:37, 22 January 2012 (UTC)

Unlikely IP is an open proxy I have to agree with hash.es on this one and say it's been down for a good while, but maybe it should go without the account creation flag? To allow legit users? -- DQ (ʞlɐʇ) 07:24, 23 January 2012 (UTC)

Like mentioned above it's an ISP proxy (http://whatismyipaddress.com/ip/202.156.10.9), but not an open proxy. We supposedly are trusting the XFF headers of MaxOnline/StarHub Cable Vision, but this particular proxy seems to be missing. I've notified folks at meta:XFF project and it hopefully will be whitelisted in the near future.
Amalthea 10:40, 23 January 2012 (UTC)

My understanding of XFF is not that strong, but we actually don't put our trust in the cite you list above as it's been known to have incorrect information. Does MaxOnline/Starhub do XFF for us? -- DQ (ʞlɐʇ) 17:40, 23 January 2012 (UTC)

I'm not asking you to put trust in any site, I'm using it since it is convenient summary of the situation as I see it. I'll be more verbose:
Reverse-lookup of 202.156.10.9 produces 202.156.10.9.cache.maxonline.com.sg. This IP gives every indication to be an ISP proxy; among other signs, requests through it are sending XFF headers. I know that VoA added MaxOnline/StarHub Cable Vision to the list of XFF-trusted ISPs at meta:XFF project, and that a proxy of that ISP (IP 218.186.9.1, reverse-lookup 218-186-9-1.cache.maxonline.com.sg) is listed on http://www.wikimedia.org/trusted-xff.html; I don't know the process for selecting those trusted proxies, but I assume that 202.156.10.9 can be added there as well, so I wrote a mail to the address noted on meta:XFF project suggesting to add it. Amalthea 18:14, 23 January 2012 (UTC)

I wasn't trying to indicate that you were asking me to put my trust in that site. And thanks for the clarification on that, I now have some new bookmarks :) -- DQ (ʞlɐʇ) 20:43, 25 January 2012 (UTC)

Sorry that I was thinking you were trying to indicate that I was asking you to trust in that site. ;) And you are right of course that whatismyipaddress.com is not always correct or up to date; for me it has always been a good starting point -- no more, no less.
You should update that one new bookmark by the way, the site I linked to isn't actually kept in synch with the repository; current list in MediaWiki trunk is here, current wmf branch is probably this one.
Tim Starling added this IP yesterday, so I guess this block can be lifted, but should never see edits. Amalthea 15:50, 26 January 2012 (UTC)

Unblocked per above as trusted XFF host. — madman 04:39, 6 February 2012 (UTC)

222.166.181.231

– A proxy check has been completed and it is now awaiting administration and close.

222.166.181.0/24 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Though their specific statements about 222.166.181.43 to 22.166.181.159, 222.166.181.43 to 22.166.181.231

Requests through unblock-en for clearance or to grant IP-exemption for account. — billinghurst sDrewth 14:34, 23 January 2012 (UTC)

Reason: Requested unblock.

I saw the statement on the list and according to the block logs I think those all should be 222 for the first octet. But looking into. -- DQ (ʞlɐʇ) 17:31, 23 January 2012 (UTC)

Unlikely IP is an open proxy Right now i'm not seeing it for all 222s. There was one minor piece of evidence that was odd, but nothing to indicate anything I can go on. -- DQ (ʞlɐʇ) 21:08, 25 January 2012 (UTC)

Can this be closed? Billinghurst (talk · contribs) should be IP-block exempt as an admin, so I don't know that any administration is needed. — madman 04:45, 6 February 2012 (UTC)

216.52.185.72

– This proxy check request is closed and will shortly be archived by a bot.

216.52.185.72 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Repeated abuse from IP, currently reported on WP:AIV. Geolocate lists the IP as a "confirmed proxy server" RA0808 ^talk_contribs 15:19, 23 January 2012 (UTC)

We actually don't put our faith in the site you source, it's frequently unreliable. I'm not seeing anything from my end right now to indicate a proxy, but I don't fully trust all the checks i'm running right now because of the location i'm in. I'll give it another check later. -- DQ (ʞlɐʇ) 17:37, 23 January 2012 (UTC)

Interesting, I'm now getting stuff since changing locations. Though with this requested login, I think were dealing with a closed proxy unless a default password is in place, but would like someone to triple for me to be sure. -- DQ (ʞlɐʇ) 21:13, 25 January 2012 (UTC)

It's a corporate firewall/filtering service. Treat it the same way you would a schoolip vandalism (generally, an increasing duration of mostly soft-blocks). Sailsbystars (talk) 22:41, 30 January 2012 (UTC)

178.63.97.34

– This proxy check request is closed and will shortly be archived by a bot.

178.63.97.34 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits. I used the tor check tool which seemed to indicate that it was a tor node that exited to wikipedia, but figured it was worth reporting. Currently is blocked for 3 months, email and talkpage blocked since it was being abusively abusive, abusively. Syrthiss (talk) 18:47, 24 January 2012 (UTC)

IP is an open proxy it's Tor. Upgraded to hardblock. -- DQ (ʞlɐʇ) 21:03, 25 January 2012 (UTC)

68.190.12.40

– A proxy check has been completed and it is now awaiting administration and close.

68.190.12.40 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

70.170.64.3 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

50.40.100.87 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

69.127.154.215 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

71.175.183.150 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Beetstra and XLinkBot are having a little battle with a morphing set of domains, and a few IP addresses. Needing to determine whether it is corrupted, open, owned. Have a series that belong to same case. There are more. however, this should give a good indication of whether it is open proxy abuse. Thanks. — billinghurst sDrewth 03:45, 26 January 2012 (UTC)

Reason: Requested block.

Here is some info on your hosts:

68.190.12.40 (talk · contribs · info · WHOIS) - Possible IP is an open proxy - Charter Communications, normal ISP - I can`t activate a proxy, but there is definitely something suspicious here that`s not normal for an ISP. Possible that a login is required, but I can`t even find that.

70.170.64.3 (talk · contribs · info · WHOIS) - Not an open proxy - Cox Communications, normal ISP

50.40.100.87 (talk · contribs · info · WHOIS) - This is not an open proxy, but it sure looks like a closed proxy. Possible peer to peer service active - Frontier Communications, normal ISP

69.127.154.215 (talk · contribs · info · WHOIS) - Not an open proxy - CSC Holdings

71.175.183.150 (talk · contribs · info · WHOIS) - Not an open proxy - Verizon Online, normal ISP

This looks like you've got someone who has access to multiple computers across the United States or a peer-to-peer network, but no open proxies to report as far as I see. -- DQ (ʞlɐʇ) 04:37, 26 January 2012 (UTC)

64.76.75.58

– This proxy check request is closed and will shortly be archived by a bot.

64.76.75.58 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

From User_talk:64.76.75.58: "This is not really an open proxy. It's a transparent proxy for the customers of IFotoncorp (ifotoncorp.com), a small (as in <200 customers) ISP in the Galapagos islands."

Reason: Requested unblock.

Admin comment - I found this through Unblock Requests, although the IP block is not active. I can't figure out what is going on, but I'm sure a tech wizard here might sort it out. Apologies if this is time-wasting. Manning (talk) 11:14, 29 January 2012 (UTC)

User:Mbethke posted that unblock request, and he currently has an unblock request on his talkpage. Took the liberty of looking, and I have to say Inconclusive because I was getting some kind of response on the HTTP side of things, to the point where I had a supposed certificate for (something).example.com but it timed out on the connection, so I'm not sure. -- DQ (ʞlɐʇ) 15:03, 29 January 2012 (UTC)

Erm... the block log looks empty to me? Not sure what's going on here.... Sailsbystars (talk) 22:34, 30 January 2012 (UTC)

I dealt with this via private email, all proxies that exist are blocked. He's IPBE'd right now. -- DQ (ʞlɐʇ) 04:37, 31 January 2012 (UTC)

106.187.43.220

– A proxy check has been completed and it is now awaiting administration and close.

106.187.43.220 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested an unblock. Claims the open proxy was a misconfiguration and has since closed the open squid on port 3128.--v/r - TP 13:39, 29 January 2012 (UTC)

He's cleared up the proxy on 3128, but it doesn't explain why he's editing from a webhost. I'm going to unblock because it's not being used abusively as far as I can tell, but please do watch the source that this came from carefully. If it's from unblock-en-l, offer to create him an account. -- DQ (ʞlɐʇ) 15:12, 29 January 2012 (UTC)

74.236.56.26

– This proxy check request is closed and will shortly be archived by a bot.

74.236.56.26 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Appeal at unblock-en-l. I am unable to confirm that this IP address is still running an open proxy. --Chris (talk) 15:05, 29 January 2012 (UTC)

Proxy looks gone to me, unblocked. -- DQ (ʞlɐʇ) 15:18, 29 January 2012 (UTC)

Agree with DQ, looks like it was only briefly a proxy. Sailsbystars (talk) 22:35, 30 January 2012 (UTC)

213.239.192.110

– This proxy check request is closed and will shortly be archived by a bot.

213.239.192.110 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits IP previously blocked as proxy. The only recent contribution is an attack on another user (http://en.wikipedia.org/w/index.php?title=User_talk:Sparthorse&diff=prev&oldid=474051216), previous contribution[2] suggests it is probably a web proxy. Peter E. James (talk) 19:46, 31 January 2012 (UTC)

Unnecessary Webhost that I just nuked. Robtex tells all. -- DQ (ʞlɐʇ) 23:46, 1 February 2012 (UTC)

74.207.231.113

– This proxy check request is closed and will shortly be archived by a bot.

74.207.231.113 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

74.72.208.192 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

Note 74.72.208.192 (talk · contribs · info · WHOIS) added this so i'm adding him as a likely suspect. -- DQ (ʞlɐʇ) 23:32, 1 February 2012 (UTC)

Unnecessary Webhost block is valid, second one not a proxy by WP:DUCK signs. -- DQ (ʞlɐʇ) 00:56, 2 February 2012 (UTC)

110.34.4.242

– This proxy check request is closed and will shortly be archived by a bot.

110.34.4.242 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

See User talk:Sudip Regmi. User claims it isn't a open proxy, would appreciate some advice. --Closedmouth (talk) 11:31, 1 February 2012 (UTC)

Likely IP is an open proxy Hash.es gives some interesting info. The proxy is likely around, just not right now... so asking for a hold/2nd opinion here. Also note something funny when I try to web address it on 8080. -- DQ (ʞlɐʇ) 01:42, 2 February 2012 (UTC)

Definitely an ISP proxy, though it would appear to require authentication... user seems to have a non-disruptive history, maybe IP block exemption? I definitely would not recommend unblocking this one. — madman 19:50, 4 February 2012 (UTC)

I am able to use 116.66.194.33:8080 as an open proxy, which terminates at 110.34.4.242:

$ http_proxy=http://116.66.194.33:8080 wget -q -O - http://automation.whatismyip.com/n09230945.asp
110.34.4.242

This is absolutely still an open proxy, and it should remain blocked. --Chris (talk) 09:52, 6 February 2012 (UTC)

Thanks, Crazycomputers. I wasn't able to connect through the 116 address the other day, but since it appears to be back, I have declined the unblock request. I'm willing to grant an IPBE if the user agrees not to misuse it and it'll be removed later, etc. Watching user talk page. — madman 14:32, 6 February 2012 (UTC)

I wonder if it's perhaps an infected computer? Maybe when they shut down their box at night that's why we can't reach the proxy. :) --Chris (talk) 17:15, 6 February 2012 (UTC)

Thinking about it, that's almost certainly the case and explains why the connection terminates at the ISP proxy's address. — madman 19:27, 6 February 2012 (UTC)

96.44.163.76

– This proxy check request is closed and will shortly be archived by a bot.

96.44.163.76 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

I am a User:Ramaksoud2000 and I'm reporting this proxy myself from this proxy because it is a tor exit relay. I'll be signing here as Ramaksoud2000 shortly to confirm but this is a tor exit relay and should be blocked.

Confirmation: Ramaksoud2000 ^{(Did I make a mistake?)} 01:54, 2 February 2012 (UTC)

Confirmation: 96.44.163.76 (talk) 01:55, 2 February 2012 (UTC)

• I have confirmed that this is a tor exit node opening to Wikipedia. I have blocked the IP address for 6 months, and am marking this report as checked. Please let me know if anyone more experienced in these matters think this was not the right way to handle this. JamesBWatson (talk) 13:17, 3 February 2012 (UTC)
  • Thanks JamesBWatson. I've confirmed IP is an open proxy and am closing. — madman 04:19, 6 February 2012 (UTC)

129.11.76.229

– This proxy check request is closed and will shortly be archived by a bot.

129.11.76.229 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock at User talk:Sceptre - this is a university proxy server so the block is likely affecting a number of users. ​—DoRD (talk)​ 15:55, 3 February 2012 (UTC)

I went ahead and unblocked. There definitely was a proxy port there in early January 2012, but I can't connect through it. Materialscientist (talk) 07:18, 5 February 2012 (UTC)

Not an open proxy — madman 03:36, 6 February 2012 (UTC)

94.23.158.24

– This proxy check request is closed and will shortly be archived by a bot.

94.23.158.24 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

This is a dedicated server that I administer. It is not acting as a proxy. draeath (talk) 22:25, 3 February 2012 (UTC)

Not an open proxy – Have granted IP block exemption to Draeath (talk · contribs). — madman 19:21, 4 February 2012 (UTC)

94.23.251.210

– This proxy check request is closed and will shortly be archived by a bot.

94.23.251.210 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

This is a dedicated server that I administer. It is not acting as a proxy. Reason: Requested unblock. draeath (talk) 22:25, 3 February 2012 (UTC)

Not an open proxy – Have granted IP block exemption to Draeath (talk · contribs). — madman 19:21, 4 February 2012 (UTC)

108.59.252.58

– This proxy check request is closed and will shortly be archived by a bot.

108.59.252.58 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Escapeeyes again.

Verified this IP and blocked 108.59.240.0/20. Materialscientist (talk) 07:31, 5 February 2012 (UTC)

129.11.76.229

– This proxy check request is closed and will shortly be archived by a bot.

129.11.76.229 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

• Unblock-en-l request. Forwarding here so someone can do this if I forget. -- DQ (ʞlɐʇ) 18:05, 5 February 2012 (UTC)

  Not an open proxy. Unblocked by Materialscientist (talk · contribs) above. — madman 03:32, 6 February 2012 (UTC)

• For my notes: Reply sent on Unblock-en-l. -- DQ (ʞlɐʇ) 20:50, 8 February 2012 (UTC)

98.143.144.0/20

– This proxy check request is closed and will shortly be archived by a bot.

98.143.144.0/20 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

• Haven't even looked into, from unblock-en-l, inviting blocking admin in to discuss. -- DQ (ʞlɐʇ) 18:41, 5 February 2012 (UTC)

• Sorry, I don't remember anything behind the circumstances of this block. Anyone is free to overturn it if they don't think that this is an open proxy. NW (Talk) 18:45, 5 February 2012 (UTC)

• Per the talk page, it looks like this may have been americanproxy.org at one point, but that site appears to be defunct. I'm going to take a while to search this range just to make sure. — madman 03:46, 6 February 2012 (UTC)

I am independently running a scan of this range and will report back with my findings. --Chris (talk) 21:05, 7 February 2012 (UTC)

After an nmap of this range and a run of my proxy checking script over the open ports, nothing turned up. There was one host that accepted proxy requests, but replied to every request with 302 Found and changed the scheme to https. Not sure what that's about, but it didn't actually do any proxying. --Chris (talk) 22:23, 7 February 2012 (UTC)

Not an open proxy. --Chris (talk) 16:34, 8 February 2012 (UTC)

Unblocked. --Chris (talk) 21:01, 8 February 2012 (UTC)

• (edit conflict) I'm not totally understand what i'm looking at either, but agree with the unblock at this point. -- DQ (ʞlɐʇ) 21:22, 8 February 2012 (UTC)

196.46.241.122

– This proxy check request is closed and will shortly be archived by a bot.

196.46.241.122 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

• Unblock-en-l request. -- DQ (ʞlɐʇ) 19:02, 5 February 2012 (UTC)
  • IP is an open proxy. — madman 04:13, 6 February 2012 (UTC)

204.69.190.254

– This proxy check request is closed and will shortly be archived by a bot.

204.69.190.254 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

User seems a little irritated about the block and insists that it's not a proxy. Daniel Case (talk) 19:26, 5 February 2012 (UTC)

Not an open proxy. The blocking administrator may have mistaken a shared IP address (which may be the case) with an open proxy. — madman 04:18, 6 February 2012 (UTC)

This is St. John's College. "Open proxy" is just one line below "schoolblock" in the block popup list. This may also be a reason for IPs blocked indef instead of 3 hr :-D. Materialscientist (talk) 04:25, 6 February 2012 (UTC)

I've changed the block to an {{anonblock}} then, as was probably intended. Account creation is still blocked, but the user may create an account and edit by following the instructions in the block message. — madman 04:57, 6 February 2012 (UTC)

182.50.64.71

– A proxy checker has placed this case on hold pending further information or developments.

182.50.64.71 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

• Unblock-en-l. -- DQ (ʞlɐʇ) 21:05, 5 February 2012 (UTC)
  • Likely IP is an open proxy – I can't connect through port 80 as ProcseeBot indicated and confirm it, but it looks like an ISP proxy, one that's in half a dozen blacklists for link spamming, in some cases advertising child pornography. And ProcseeBot did flag it relatively recently. I wouldn't recommend unblock, maybe account creation and a change to softblock. (Not IPBE as I don't know that there's a history of positive contributions.) — madman 15:33, 6 February 2012 (UTC)
    • I should note that nmap doesn't return anything at all. There is either no computer with this IP or it's dropping all incoming traffic. Further, stopforumspam has seen no activity in 17 days, and when there was activity there were spans of no activity only lasting a day or two. This proxy may have been taken down. I'd suggest we look at it again in a week or two. --Chris (talk) 17:04, 7 February 2012 (UTC)
      • Switched to softblock, recheck down the road. I have to agree that this is too likely to not be one, but WP:AGF. -- DQ (ʞlɐʇ) 21:37, 8 February 2012 (UTC)

201.9.177.212

– A proxy checker has declined a request for a check, and the case is now awaiting administration.

201.9.177.212 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.

I don't see any block on this IP. Do you mean autoblock? Materialscientist (talk) 00:42, 6 February 2012 (UTC)

As Materialscientist indicates, there is no outstanding block on this IP. Therefore no check is necessary. --Chris (talk) 16:39, 8 February 2012 (UTC)

50.22.226.81

– A proxy check has been completed and it is now awaiting administration and close.

50.22.226.81 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Suspected proxy once more of Escapeeyes, who now is insulting Purrum as some of her other favourite targets have been recently protected.

Reason: Suspicious edits

Confirmed this IP and blocked for 6 months. Materialscientist (talk) 08:52, 6 February 2012 (UTC)

184.22.125.132

– This proxy check request is closed and will shortly be archived by a bot.

184.22.125.132 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Escapeeyes. --GenericBob (talk) 07:40, 6 February 2012 (UTC)

Open proxy blocked. (Browser-based proxy.) --Chris (talk) 16:57, 7 February 2012 (UTC)

178.63.32.109

– A proxy checker has declined a request for a check, and the case is now awaiting administration.

178.63.32.109 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Escapeeyes. --GenericBob (talk) 07:41, 6 February 2012 (UTC)

Unlikely IP is an open proxy. The IP appears to belong to a VPS. Port 8081 is open but does not appear to proxy anything. --Chris (talk) 17:01, 7 February 2012 (UTC)

Declined to run a check Webhost blocked. -- DQ (ʞlɐʇ) 21:41, 8 February 2012 (UTC)

220.255.2.121

– This proxy check request is closed and will shortly be archived by a bot.

220.255.2.121 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Block message: {{blocked proxy}} <!-- 115.66.71.229:8888 -->

I am unable to verify that this proxy is still open. Estavali (talk · contribs) has requested that this address be unblocked. --Chris (talk) 09:34, 6 February 2012 (UTC)

I think there was a transient proxy there in January but not anymore. Materialscientist (talk) 09:43, 6 February 2012 (UTC)

I checked again today and I can't find anything, so Not an open proxy.

88.208.234.187

– This proxy check request is closed and will shortly be archived by a bot.

88.208.234.187 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

On behalf of Fnagaton (talk · contribs). --Chris (talk) 09:38, 6 February 2012 (UTC)

This seems like a CU block to me rather than a proxyblock, thus asked Tnxman307 (blocking admin/checkuser). Materialscientist (talk) 09:51, 6 February 2012 (UTC)

Unblocked by Tnxman307. Materialscientist (talk) 22:37, 6 February 2012 (UTC)

96.8.113.52

– This proxy check request is closed and will shortly be archived by a bot.

96.8.113.52 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Escapeeyes. --GenericBob (talk) 07:27, 7 February 2012 (UTC)

Confirmed web proxy on 96.8.113.52, blocked 96.8.112.0/23 (hosting range, low activity) - feel free to amend block parameters. Materialscientist (talk) 09:21, 7 February 2012 (UTC)

173.192.118.68

– This proxy check request is closed and will shortly be archived by a bot.

173.192.118.68 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

173.192.0.0/16 blocked by Zzuuzz, ({{blocked proxy}}: <!-- SoftLayer Technologies hosting range -->).

Reason: Requested unblock at User talk:Speeddymon. The user says "The IP in question is the external endpoint IP for SoftLayer's corporate office network. No idea why they use a proxy, but I am reasonably sure that the single IP could be whitelisted without causing any further spamming since it is separate from the rest of the hosted customers.

Side note, I had to post this from my phone on 4G because I can no longer even edit my talk page on the company network. ". JamesBWatson (talk) 22:03, 7 February 2012 (UTC)

If we forgo the proxy check for now and assume that the range is clear, the existing 173.192.0.0/16 block will have to expand into these blocks to exclude the 173.192.118.0/24 range:

• 173.192.0.0/18
• 173.192.64.0/19
• 173.192.96.0/20
• 173.192.112.0/22
• 173.192.116.0/23
• 173.192.119.0/24
• 173.192.120.0/21
• 173.192.128.0/17

So... should we consider doing that (more block maintenance, less collateral damage) or just go the IPBE route (easy fix, but may have to grant IPBE to more accounts later)? --Chris (talk) 22:20, 7 February 2012 (UTC)

Not an open proxy. I was unable to find any open proxies in the 173.192.118.0/24 range. The remaining question now is how do we deal with the wider rangeblock. --Chris (talk) 23:30, 7 February 2012 (UTC)

I've Googled the /16 range and here is what I've got: there are tons of web and http proxies in the range and some web proxies are below (verified). The 173.192.118.0/24 range seems clean, but there are some ghosts like freewebproxy.co, which was (is?) sitting in the 173.192.64.0/18 range. To sum up, the /16 range is rotten, but I have no direct evidence there is an active proxy in the particular 173.192.118.0/24 subrange. A possible compromise is "anonblock" on /16, i.e. release users who are already registered. Materialscientist (talk) 11:38, 8 February 2012 (UTC)

proxyactive.com 173.192.30.234 173.192.0.0/18

proxiesunlimited.com 173.192.130.216 173.192.128.0/18

unblockwebsitenow.com 173.192.208.79 173.192.192.0/19

passonme.info 173.192.216.119 173.192.192.0/19

I'm not sure I like the idea of a softblock. :/ --Chris (talk) 15:07, 8 February 2012 (UTC)

I've applied IPBE to Speeddymon (talk · contribs). --Chris (talk) 18:26, 8 February 2012 (UTC)

76.118.180.210

– A proxy check has been completed and it is now awaiting administration and close.

76.118.180.210 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits The IP is clearly a sock of someone - see unblock request decline.

I looked up the ip on http://whatismyipaddress.com/blacklist-check: both The Spamhaus Project and Spam and Open Relay Blocking System came back red for that IP. The IP was already blocked for other disruption at that point. Several adjustments to the block were made, but I ultimately restored the original disruption block, questioning the results from the blacklist check. This seems like a better route to verify the existance of an open relay/proxy. Toddst1 (talk) 23:07, 7 February 2012 (UTC)

Not an open proxy, or at least this is not the entry point. --Chris (talk) 23:49, 7 February 2012 (UTC)

Not an open proxy I'm not seeing it here either. -- DQ (ʞlɐʇ) 22:01, 8 February 2012 (UTC)

Webhost vandal

– A proxy check has been completed and it is now awaiting administration and close.

79.170.95.63 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits. Vandalising Canadian websites from an IP that seems to resolve to Rotterdam, the Netherlands. Possible proxy. Vale of Glamorgan (talk) 01:09, 8 February 2012 (UTC)

Not an open proxy. Most ports were filtered by a firewall, but port 8080 was closed. This may indicate that a proxy was previously running, but I cannot verify that one is any longer. --Chris (talk) 04:37, 8 February 2012 (UTC)

90.156.197.86 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits

Moscow IP has just made identical edit as suspected Rotterdam proxy (immediately above). Vale of Glamorgan (talk) 01:47, 8 February 2012 (UTC)

Not an open proxy. --Chris (talk) 04:48, 8 February 2012 (UTC)

77.79.4.145 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits. Same edit as Rotterdam and Moscow but now it's from Lithuania. Vale of Glamorgan (talk) 02:25, 8 February 2012 (UTC)

Not an open proxy. --Chris (talk) 05:27, 8 February 2012 (UTC)

• Merged. For the record, all there all are rangeblocked because they are webhosts. -- DQ (ʞlɐʇ) 00:14, 9 February 2012 (UTC)

81.98.21.251

– A proxy check has been completed and it is now awaiting administration and close.

81.98.21.251 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

User claims that the tool used delivers a lot of false poses that would lead us to block his entire range (However, there may be a subtext to this. See this recent AN/I thread. Daniel Case (talk) 03:35, 8 February 2012 (UTC)

Not an open proxy. --Chris (talk) 05:37, 8 February 2012 (UTC)

68.71.39.10

– This proxy check request is closed and will shortly be archived by a bot.

68.71.39.10 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Geolocate indicates name of registered organization is Peacefire, typing IP directly into the address bar leads to a Peacfire Circumventor Site. RA0808 ^talk_contribs 05:37, 17 February 2012 (UTC)

Open proxy blocked. --Chris (talk) 05:41, 17 February 2012 (UTC)

See also

Subpages

• Blacklist of open or zombie proxies
• Information for blocked users
• List of users who can verify proxies
• Preventing access to wikipedia from your Tor node

Related pages

• Policy on open proxies
• Open proxy detection
• Guide to checking open proxies
• Proxy check result templates
• Advice to users using Tor to bypass the Great Firewall
• meta:XFF project
• Tor exit checker

Chapters

• Meta-Project
• Wikisource
• Wikiversity
• Wiktionary

Directory of WikiProjects

WikiProject Council

Guide to WikiProjects